Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    15/02/2024, 13:39

General

  • Target

    1.exe

  • Size

    1.1MB

  • MD5

    69e37fcc0df26cb81fd06e5dfb260144

  • SHA1

    839808ef40530e153fdb1f0fdb390b56c1982b6d

  • SHA256

    44751e144b4dae403bf009e1a5461d0b7ec7b0f5e95ae6b149e0c653e4ab7b17

  • SHA512

    5361c923c58330ba71f72374341543a7863223592489526f3d561a7d6f010a3a63ce6559f85474458097ebc818b77073cfb5a648c4084a95d7eaa5c31f2e860c

  • SSDEEP

    24576:pRmJkcoQricOIQxiZY1ia7oOq0/WkgZ6Xw1EGBHS:mJZoQrbTFZY1ia7oOLW6A1E+HS

Malware Config

Extracted

Family

remcos

Botnet

jnchinacp

C2

jnchina.ydns.eu:1177

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-1632I1

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 3 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 9 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1.exe
    "C:\Users\Admin\AppData\Local\Temp\1.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1488
    • C:\Users\Admin\AppData\Local\outvaunts\resharing.exe
      "C:\Users\Admin\AppData\Local\Temp\1.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\1.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2696
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\farhgeqgzjjpitnu"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:580
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\puwagwbznrcukhjyhmgd"
          4⤵
          • Accesses Microsoft Outlook accounts
          PID:1632
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\swbkhpmbjzugvnxcyxbfcof"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2840
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\mdxcdogmxwy"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2608
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\xfduegrgleqfjuq"
          4⤵
          • Accesses Microsoft Outlook accounts
          PID:2204
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\hzqnfybhzmijtbmyse"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1600

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\remcos\logs.dat

          Filesize

          144B

          MD5

          9d2b593ead05857964a464aca049646c

          SHA1

          294445d9a907b5fdf1f76037388b9079bf4b9993

          SHA256

          e46fc1c745851b06f4bb993294f9b70bb9d116ca9f379169ebada199adc2b5a9

          SHA512

          3c100ce34e250a5d3eee90f0bdfb97ba8454edd111feeb8f42889ddb63596da39cee9cfc49a011e158c027e50833b2a8517c314616c506efd8e02441a0e7ef4a

        • C:\Users\Admin\AppData\Local\Temp\mdxcdogmxwy

          Filesize

          2B

          MD5

          f3b25701fe362ec84616a93a45ce9998

          SHA1

          d62636d8caec13f04e28442a0a6fa1afeb024bbb

          SHA256

          b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

          SHA512

          98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

        • C:\Users\Admin\AppData\Local\Temp\tilths

          Filesize

          483KB

          MD5

          9dbad0aa8d1f4a6e7c5d3300f4a79911

          SHA1

          278790865ad59208d4b82100a255e5eabbffa041

          SHA256

          901d7920b2aa2272f92d09cda4d4dc56f5c5dc1d81ec4b1b15ab09e750085779

          SHA512

          bbe9d8b5bb9d269bf0fc9f12e720ad51fecfdedb10d679d7e8115f49aca2d658b7cf50d51dc87cb03b47f53f61975bb742793b07d40582de1c3641760eca531a

        • C:\Users\Admin\AppData\Local\Temp\unrosined

          Filesize

          96KB

          MD5

          e04d5020cdf6b54ca1aeafb897bb0de0

          SHA1

          3483ddcfc66d801c03a8c18506b489da38c5833b

          SHA256

          fe6f63c2b6ae9d1bc7481a0ca3c2aac7187a9ef715043e1773f3d3ceed70a797

          SHA512

          2298ba958ce9a721e6aafd0da706adeac7fe87d040778c278ed6931723318823036e5643b72ef0f3abebca9917c6f419eda4e2ab104370afdc19940dec9b14c2

        • C:\Users\Admin\AppData\Local\outvaunts\resharing.exe

          Filesize

          1.2MB

          MD5

          83652ef746cc7552e00aeb54c573ef9b

          SHA1

          9a17fa120f6785a36ba47004922f0973bd3c2592

          SHA256

          0d1b66cca7315150920634abc79e4577af51dbff1e952141e39fc237e2fe26ba

          SHA512

          cc5866d516e90c4998f1255a2ae60bbb4186cee0532c940fe56c4dda26ffacbc1d6af96b638685ad1c2e932f6c1e91cd9c71bd71259c43650869a76bdb2b9d93

        • C:\Users\Admin\AppData\Local\outvaunts\resharing.exe

          Filesize

          1.2MB

          MD5

          220f535f8e88665d3fa1051916801a60

          SHA1

          3377c81da3a3ebc8e931eb583c28a6446de3df48

          SHA256

          033966f1a8e7959997f4ae67fa0505b98a87ce0159e480b204d8cfe49d601aaa

          SHA512

          850e86f405b7878d31723f13c8c43ab001ada3577bf3053246ef8b64bc9c48a2f6e6992aec1e9fc9b4e6f5da3388650bd3a198dbdebfed5d8dc2bdca51b3253d

        • \Users\Admin\AppData\Local\outvaunts\resharing.exe

          Filesize

          768KB

          MD5

          628401eacfe473cb396f59eb990b32e8

          SHA1

          c7cf7bb9ec6329f296a7cc666ce7cfb78f03e332

          SHA256

          b93c1b783ffb0198868aad668ba1d24acf977df1cb9185624ba998bfb8bc1228

          SHA512

          71ab1b73eb3787779c1743e98b4bb34b25bed889f365c0faacba407de8187a16b161121fbf6a8d80ae195853222a7045d6cc28dafeb74a3f4a4e967a3353f97c

        • memory/580-48-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/580-99-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/580-64-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/580-56-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/580-50-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/1488-10-0x0000000000390000-0x0000000000394000-memory.dmp

          Filesize

          16KB

        • memory/1600-98-0x0000000000400000-0x0000000000424000-memory.dmp

          Filesize

          144KB

        • memory/1632-65-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB

        • memory/1632-54-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB

        • memory/1632-86-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB

        • memory/1632-62-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB

        • memory/2204-90-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB

        • memory/2608-106-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/2696-110-0x0000000010000000-0x0000000010019000-memory.dmp

          Filesize

          100KB

        • memory/2696-44-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2696-136-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2696-38-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2696-41-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2696-129-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2696-37-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2696-36-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2696-128-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2696-47-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2696-121-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2696-120-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2696-118-0x0000000010000000-0x0000000010019000-memory.dmp

          Filesize

          100KB

        • memory/2696-70-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2696-71-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2696-46-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2696-89-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2696-40-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2696-34-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2696-33-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2696-43-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2696-105-0x0000000010000000-0x0000000010019000-memory.dmp

          Filesize

          100KB

        • memory/2696-32-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2696-109-0x0000000010000000-0x0000000010019000-memory.dmp

          Filesize

          100KB

        • memory/2696-111-0x0000000010000000-0x0000000010019000-memory.dmp

          Filesize

          100KB

        • memory/2696-42-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2696-112-0x0000000010000000-0x0000000010019000-memory.dmp

          Filesize

          100KB

        • memory/2696-113-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2696-30-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2840-69-0x0000000000400000-0x0000000000424000-memory.dmp

          Filesize

          144KB

        • memory/2840-67-0x0000000000400000-0x0000000000424000-memory.dmp

          Filesize

          144KB

        • memory/2840-68-0x0000000000400000-0x0000000000424000-memory.dmp

          Filesize

          144KB

        • memory/2840-66-0x0000000000400000-0x0000000000424000-memory.dmp

          Filesize

          144KB

        • memory/2840-60-0x0000000000400000-0x0000000000424000-memory.dmp

          Filesize

          144KB

        • memory/2840-55-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB